It is perfectly normal for responsible software developers, system administrators and business leaders to get angry or upset by security vulnerabilities. The impact such vulnerabilities can have on an organization is staggering.

When they're exploited, there can be huge sums of money lost. There can be serious legal ramifications. A company's reputation can be destroyed by a single incident. And those are just a few of the consequences.

Even when these vulnerabilities aren't exploited, there are still significant costs associated with fixing them, testing such fixes, deploying the fixes, and so forth.

Software is supposed to bring benefits to its users, not problems and costs. Costly problems with software will make many people angry.

Ruby, Ruby on Rails and some related software have had a very bad time lately. They have caused a lot of problems for a lot of people, and this has indeed resulted in anger and wasted monkey. Some people are making a sensible decision to look toward alternative technologies, to try to minimize their losses.

Instead of labeling such people as "trolls", the Ruby community as a whole needs to engage in some significant self-evaluation. Try to understand why people are expressing what they are, and perhaps even try to learn from what they're saying. Security is important, and the Ruby community needs to learn this fact.

> Ruby sucks

Ruby actually does suck. I don't like it; that's my personal opinion.

But I can't say that. All the cool startups are using it, so Ruby has become one of HN's sacred cows: There are people on here, like the parent, who take offense when someone dares have anything but the highest praise for Ruby and Rails.

I've looked at Ruby. The syntax is ugly; the language is about as bad as Perl in this regard. I've deployed Ruby applications; it's complex (although, to be fair, this is endemic to Web development). Rails is a nightmare.

A lot of HN'ers seem to like it. That's fine. But we should listen to unpopular opinions; important truths aren't always immediately universally accepted as such.

Problem: Maybe Ruby is actually the best thing since sliced bread, but I don't understand its greatness because I haven't seen the right tutorial. Solution: Write a better tutorial, improve existing ones, or point out your favorite beginning Ruby tutorials on HN or your blog.

Problem: Maybe the syntax of Ruby is really what makes me uncomfortable. Solution: A Python-to-Ruby bridge would let people like me experience the goodness of Rails without the pain of learning Ruby's extensive syntactic "innovations."

Problem: The grandparent's employer was uncomfortable with the number of security vulnerabilities recently found in Rails. Solution: Maybe having a stable branch which didn't innovate quite as fast and focused on security would make enterprise users more comfortable with Rails. Or maybe the Rails community needs more thorough vetting of new features for potential security holes, perhaps through requiring separate reviews for security and functionality before patches are officially accepted.

But if we just dismiss anyone who criticizes Ruby as a troll, how are we supposed to recognize and respond to actual problems like these? The grandparent's issues were a legitimate criticism of Ruby, and should not have been downvoted.

The high chance that more catastrophic rails exploits will be found in the next month (if all of the paths to YAML.load have been found, I'll eat my hat) will increase the number of people making or agreeing with statements like static_typed's. After an exploit or two have been found in February or March, people will be pointing at Rails and saying 'I told you so'.